SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?
⚠ Common exam trap
Test-takers frequently confuse ransomware with a worm because both can spread rapidly, but the key differentiator is the encryption of files and the presence of a ransom demand, which is unique to ransomware.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ransomware that encrypts files and demands payment for recovery
The user's symptoms—unopenable files with strange extensions and a ransom note—are classic indicators of ransomware. Ransomware encrypts files using a symmetric key (e.g., AES-256) and then demands payment, typically in cryptocurrency, to provide the decryption key. This matches the scenario exactly, as the files are rendered inaccessible and a note is left behind.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spyware that silently records user activity over time
Why it's wrong here
Spyware’s core purpose is covert surveillance, such as keylogging, screen capture, or credential theft, and it deliberately avoids noisy actions like locking files or rebooting. Even if spyware causes instability or performance degradation, it never presents a payment demand or cryptographically renders user data inaccessible. A sudden, mass-scale loss of file access accompanied by a ransom note is therefore far more consistent with encryption-based extortion than with information-stealing malware.
- ✓
Ransomware that encrypts files and demands payment for recovery
Why this is correct
Ransomware is purpose-built to deny users access to their own data by encrypting files with a symmetric algorithm, then often using asymmetric encryption to protect the key and display an on-screen ransom demand, typically with a deadline and cryptocurrency payment instruction. The user's report of many files suddenly becoming inaccessible matches the ransomware Playbook: it enumerates local and networked drives, encrypts a wide range of document and media types, and then drops a ransom note. This direct cause-and-effect link between the symptom and the malware's payload makes it the correct diagnosis.
- ✗
A worm that spreads mainly by scanning for other hosts
Why it's wrong here
A worm is self-replicating malware that uses network vulnerabilities or email to propagate automatically from host to host, often consuming bandwidth or dropping secondary payloads, but its defining trait is replication, not data destruction or extortion. While some worms can carry destructive or ransomware-like components, the classic worm simply copies itself and spreads by scanning IP ranges, so it would not typically produce a systematic encryption of a user's files with a payment demand. The visible outcome described—mass file lockout plus a ransom note—points to a local encryption attack rather than an autonomous network-spreading agent.
- ✗
A rootkit that hides malicious processes from the operating system
Why it's wrong here
Rootkits are stealth tools that intercept system calls, patch kernel modules, or modify device drivers to hide malicious processes, files, and registry keys from the operating system, thereby preserving remote access and evading antivirus. Their success depends on invisibility and maintaining persistence in a compromised environment, not on disrupting user access or issuing financial demands. A rootkit would silently coexist with the system, whereas the user’s report of many files becoming suddenly inaccessible and a ransom demand indicates a disruptive, overt attack, not a concealed backdoor.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.